Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name.

This update fixes a bug that allowed the client to retrieve arbitrary memory content from the server process. (CVE-2008-4314) Additionally another bug was fixed that affects environments that enabled registry shares by setting 'registry shares = yes'. In this case an authenticated user is accidentally allowed to access the root filesystem '/'. (CVE-2009-0022)

Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name (CVE-2009-0022).

This update provides samba 3.2.7 to address this issue.

Gunter Hockel discovered that Samba with registry shares enabled did not properly validate share names. An authenticated user could gain access to the root filesystem by using an older version of smbclient and specifying an empty string as a share name. This is only an issue if registry shares are enabled on the server by setting 'registry shares = yes', 'include = registry', or 'config backend = registry', which is not the default.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2009-0022

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the Samba server on the remote host is between 3.2.0 and 3.2.6 inclusive.  Such versions reportedly allow an authenticated remote user to gain access to the root filesystem, subject to his or her privileges, by making a request for a share called '' (empty string) from a version of smbclient prior to 3.0.28.  Successful exploitation of this issue requires 'registry shares' to be enabled, which is not enabled by default.

According to its banner, the version of the Samba server on the remote host is between 3.2.0 and 3.2.6 inclusive. Such versions reportedly allow an authenticated, remote user to gain access to the root filesystem, subject to his or her privileges, by making a request for a share called '' (empty string) from a version of smbclient prior to 3.0.28. Successful exploitation of this issue requires 'registry shares' to be enabled, which is not enabled by default.

Note that Nessus has not actually tried to exploit this issue or to determine if 'registry shares' is enabled or if the fix has been applied.

New samba packages are available for Slackware 12.2 and -current to fix a security issue.

ID	Name	Product	Family	Severity
40197	openSUSE Security Update : cifs-mount (cifs-mount-410)	Nessus	SuSE Local Security Checks	high
39927	openSUSE Security Update : cifs-mount (cifs-mount-406)	Nessus	SuSE Local Security Checks	high
37415	Mandriva Linux Security Advisory : samba (MDVSA-2009:042)	Nessus	Mandriva Local Security Checks	medium
37362	Ubuntu 8.10 : samba vulnerability (USN-702-1)	Nessus	Ubuntu Local Security Checks	medium
35395	Fedora 9 : samba-3.2.7-0.23.fc9 (2009-0268)	Nessus	Fedora Local Security Checks	medium
4807	Samba 3.2.0 - 3.2.6 Unauthorized Access	Nessus Network Monitor	Samba	medium
35298	Samba 3.2.0 - 3.2.6 Unauthorized Access	Nessus	Misc.	medium
35292	Slackware 12.2 / current : samba (SSA:2009-005-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2009-0022

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium